slsa

Star

Here are 39 public repositories matching this topic...

slsa-framework / slsa-github-generator

Star

Language-agnostic SLSA provenance generation for Github Actions

security security-hardening security-tools slsa slsaprovenance

Updated Nov 4, 2024
Go

chainloop-dev / chainloop

Star

Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.

security open-source-licensing compliance license spdx attestation devsecops ospo oss-compliance sbom in-toto cyclonedx slsa supply-chain-security sbom-distribution slsa-provenance metadata-platform sbom-discovery regulated-industry

Updated Nov 8, 2024
Go

Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks, detect malicious Python packages, or check conformance to frameworks, such as SLSA. Documentation:

python docker npm gradle maven build-system malware-analysis cicd integrity-protection malware-detection sbom slsa supply-chain-security

Updated Nov 8, 2024
Python

vishalgarg-sec / Software-Supply-Chain-Security

Star

A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.

cncf owasp vex vulnerability-management software-security dependency-management sbom attestations slsa open-source-security supply-chain-security supply-chain-attacks software-supply-chain-security openssf software-bill-of-material software-transparency

Updated Jan 28, 2024

mchmarny / s3cme

Star

Template Go app repo with local test/lint/build/vulnerability check workflow, and on tag image test/build/release pipelines, with ko generative SBOM, cosign attestation, and SLSA build provenance

provenance vulnerability oidc cosine attestation sbom slsa supply-chain-security

Updated Apr 23, 2024
Go

buildsafedev / bsf

Star

Developer-centric tool to secure your software supply chain.

nix reproducibility hacktoberfest slsa supply-chain-security

Updated Nov 8, 2024
Go

kubernetes-sigs / tejolote

Star

A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.

provenance attestation sbom slsa sigstore

Updated Nov 8, 2024
Go

philips-labs / slsa-provenance-action

Star

Github Action implementation of SLSA Provenance Generation

security provenance software-supply-chain hacktoberfest security-tools github-actions github-action in-toto slsa

Updated Nov 8, 2024
Go

deislabs / image-layer-provenance

Star

Container image provenance spec that allows tracing CVEs detected in registry images back to a CVE's source of origin.

docker security security-audit containers container provenance oci oci-image vulnerability vulnerabilities cve vulnerability-management vulnerability-assessment containerization security-tools container-image oras slsa slsaprovenance

Updated Oct 30, 2023
Go

jenstroeger / python-package-template

Star

An opinionated Python package/application template repository, with SLSA and SBOM support built in, enabled for security scanners, code linters, typing, testing and code coverage monitoring, and release automation for reproducible builds.